net: Fix use after free by removing length arg from sk_data_ready callbacks.

[linux.git] / net / atm / mpc.c

diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index b71ff6b234f2bb1c6d97915eb5a4fb6ab4d1851d..e8e0e7a8a23d12029440b2f01b1c10b6e6326f27 100644 (file)
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -706,7 +706,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
                dprintk("(%s) control packet arrived\n", dev->name);
                /* Pass control packets to daemon */
                skb_queue_tail(&sk->sk_receive_queue, skb);
-               sk->sk_data_ready(sk, skb->len);
+               sk->sk_data_ready(sk);
                return;
        }
 
@@ -992,7 +992,7 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
 
        sk = sk_atm(mpc->mpoad_vcc);
        skb_queue_tail(&sk->sk_receive_queue, skb);
-       sk->sk_data_ready(sk, skb->len);
+       sk->sk_data_ready(sk);
 
        return 0;
 }
@@ -1273,7 +1273,7 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
 
        sk = sk_atm(vcc);
        skb_queue_tail(&sk->sk_receive_queue, skb);
-       sk->sk_data_ready(sk, skb->len);
+       sk->sk_data_ready(sk);
        dprintk("exiting\n");
 }
 
@@ -1492,7 +1492,7 @@ static void __exit atm_mpoa_cleanup(void)
 
        mpc_proc_clean();
 
-       del_timer(&mpc_timer);
+       del_timer_sync(&mpc_timer);
        unregister_netdevice_notifier(&mpoa_notifier);
        deregister_atm_ioctl(&atm_ioctl_ops);